Increasingly enterprises are faced with numerous internal users having different access requirements that span a large number of applications, networks, and systems. Maintaining the security of such modern dynamic enterprises is a critical and challenging task. In some industries, such as banking, the federal government has promulgated rules and regulations that require a certain degree of security. Thus, enterprises are not only concerned with their reputation but face potential civil liability for security breaches. The challenge lies in efficiently and securely provisioning system access to reflect constantly changing user responsibilities and computing environments.
Historic methods of manually granting individual user access on a resource by resource basis long ago proved administratively infeasible for organizations of even moderate size. Role Based Access Control (RBAC) systems advanced the art by attempting to secure and streamline user administration via constructing and maintaining a formal model of user privileges grouped into roles.
One problem with RBAC systems is that one RBAC for one enterprise may be entirely different than another RBAC for a different enterprise. Moreover, disparate enterprises are increasingly collaborating and partnering on the Internet to share resources, revenues, customers, expenses, etc. One impediment to seamless integration and collaboration lies in each different enterprise's security system or RBAC system. Often the solution to integration is a large-scale development effort that makes the two RBAC compatible with one another or that installs a single RBAC for both enterprises. However, such a development effort can prove too costly and time consuming and may even negate any perceived benefits of the two enterprises collaborating and integrating with one another. Consequently, security integration remains a significant development exercise and financial concern with cross enterprise collaboration and integration.
Accordingly, what are needed are mechanisms to better provision security roles for users.